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CRITERIA  FOR  THE  DESIGN  A!©  USE  OF  AUTOMATED  ’ISSUE 
GROUND  EQUIPMENT  TO  IMPROVE  MISSILE  READINESS. 

Ever  since  World  War  II,  the  military  services  have  been  taking  delivery 
on  ever  increasingly  complex  weapon  systems.  Part  of  the  complexity  arose 
because  of  what  the  weapon  systems  were  supposed  to  do.  For  example, 
carrying  men  over  inter-continental  ranges  at  supersonic  speeds  is  not  a 
simple  design  problem.  Another  part  arose  because  these  systems  were 
supposed  to  do  things  that  bad  never  been  done  before.  I’m  thinking  here 
of  the  inter-continental  ballistic  missile.  Designers  were  pushed  to  the 
limit  of  their  knowledge  in  developing  these  systems.  Newness.  Complexity. 
In  hardware  design  those  two  words  are  synonyms  for  trouble. 

Take  the  inter-continental  ballistic  missile,  the  I CBM.  When  they 
attempted  to  launch  early  ICEM'a  they  discovered  some  troublesome  things. 

I'll  mention  but  two.  First,  missile  parts  failed  even  when  doing  nothing 
more  than  standing.  Now  it's  expensive  and  embarrassing  to  launch  missiles 
with  defective  parts.  One  obvious  solution  is  to  check  the  missile  before 
you  attempt  to  launch  it.  But  that  leads  to  the  second  trouble.  The  pre¬ 
paratory  checkout  procedures  required  quantities  of  skilled  manpower  and 
took  lots  of  time.  To  the  Air  Force,  this  situation  was  not  acceptable. 

The  Air  Force  doesn't  have  great  quantities  of  skilled  manpower  and,  for  a 
quick-reacting  retaliatory  weapon,  doesn’t  have  lots  of  time. 

So  it  was  only  natural  for  people  to  wonder  if  the  notions  of  automation 
could  be  applied  to  missile  checkout.  They  were  attracted  by  the  ideas  the 
mathematicians  had  used  In  developing  high  speed  computers  to  solve  problems 
in  arithmetic.  As  a  result,  a  whole  new  concept  was  bora  that  of  automatic 
checkout  equipment.  And  I’m  not  sure  but  what  Pandora's  box  flipped  it  .  lid 
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over  that  one. 

Certainly,  you  are  all  aware  that  even  one  I  CBM  1b  a  complex  thing.  So 
when  you  study  many  missiles  -  even  of  one  type  -  existing  within  a  hasing 
ani  support  system,  you  are  faced  with  a  very  J*rge,  complex  problem  which 
is  beyond  the  grasp  of  the  human  mind.  Here's  where  tne  attributes  of 
Operations  Research  can  be  profitably  used.  By  breaking  down  a  large  complex 
problem  into  parts  or  steps  while  still  retaining  a  connective  mechanism,  by 
offering  tools  or  methods  for  an  organized,  systematic  attack  upon  these 
parts,  an  operations  analyst  offers  aids  to  the  solution  of  the  overall 

problem. 

Today,  I'm  going  to  tell  you  about  one  of  these  aids.  I  will  address 
\f  one  part  of  an  overall  I  CBM  weapon  system  problem,  that  of  objective  criteria 
for  the  design  and  use  of  automatic  checkout  equipment^  Recall  that  the 
purpose  of  the  equipment  Is  to  teBt  the  mlBslle  during  Its  ground  life  -  an 
operation  which  I  call  readiness  testing.  It  follows  that  what  I  have  to 
say  must  be  Imbedded  in  the  weapon  system  context  before  overall  solutions 

are  obtained. 

What  is  the  problem  for  the  analyst  in  this  area  of  automatic  checkout 
equipment  applications?  Well,  let's  start  by  making  some  general  observa¬ 
tions.  Tou  are  familiar  with  the  conventional  numerical  descriptions  of 
military  weapons.  Altitudes,  speeds,  ranges  of  aircrafts;  CEP's,  component 
reliabilities  and  propulsive  thrust  of  missiles  are  examples.  Part  of  the 
problem  is  that  often  these  numerical  descriptions  don't  lend  themselves 
readily  to  comparative  purposes.  For  example,  one  of  the  most  difficult 
problems  for  the  military  analyst  is  to  compexe  aircraft  and  missiles.  The 
trouble  is  that  men  in  aircraft  can  do  things  that  missiles  can't  do.  Add 
it's  most  difficult  to  establish  a  value  for  the  presence  of  the  men. 
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What  ve  require  from  the  analyst  then,  is  a  means  of  combining  or  transforming 
the  conventional  numerical  descriptions  into  useful  criteria  which  can  be 
used  for  comparative  purposes.  Another  part  of  the  problem  is  that  the 
conventional  descriptions  cut  across  scientific  or  engineering  disciplines. 

Bo  when  a  system  designer  has  to  make  system  decisions,  he  frequently  falls 
back  on  intuitive  reasoning.  Judgment,  and  experience.  1  don't  mean  to 
imply  that  such  design  practice  is  all  bad.  But  I  do  claim  that  the  analyst's 
objective  aids  to  this  decision  process  will  not  only  help  but,  stating  it 
more  forcefully,  these  aids  are  needed.  Problems  of  these  kinds  are  too  large 
and  the  solutions  result  In  too  much  expense  to  rely  solely  on  subjective 
guides.  All  right,  we  have  n&de  some  general  observations  of  the  analyst  s 
problem.  Now  let's  apply  them  to  the  readiness  testing  problem  at  hand.  We 
have  noted  that  we  must  be  system  oriented.  Therefore  we  know  something  about 
the  type  of  missile  and  its  operational  and  support  environment.  But  we  must 
.1..  recognise  that  these  missiles  are  made  up  of  various  subsystems  such  as 
guidance  packages  and  propulsion  systems.  Because  the  subsystems  are  quite 
different  in  design  and  do  noticeably  different  things,  we  should  expect  a 
requirement  to  tailor  the  design  and  use  of  automatic  checkout  equipment  to 
the  particular  characteristics  of  each  subsystem.  The  analyst's  Job  is  to 
develop  an  objective  means  which  will  tell  us  how  to  choose  betyeen  various 
designs  and  uses  for  each  subsystem.  Since  we  check  a  missile  to  fina 
failures  that  are  present,  ve  are  principally  concerned  with  failure  rates, 
a  conventional  numerical  description  springing  from  reliability  data.  After 
p n  j  reliability  data  are  natural  modes  of  expressing  ground,  operating  prob¬ 
abilities.  Once  we  know  the  best  test  method  for  each  subsystem,  we  can 
establish  a  readiness  testing  program  for  the  entire  missile  by  simply  com¬ 
bining  the  individual  methods. 
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I'll  show  you  the  criterion  used  in  this  study. 

CHART  1 

Ihe  statement  is  rather  brief  so  suppose  I  talk  around  it  for  a  bit.  We 
are  interested  in  finding  failed  parts  in  an  ICBM.  One  might  think  that  to  have 
a  rapid  means  of  testing  is  enough.  We'll  test  the  missile  often  by  testing  the 
individual  subsystems  and  repair  when  necessary.  But  this  intuitive  reasoning 
can  be  wrong.  For  example,  in  an  extreme,  one  may  test  the  missile  too  often 
and  find  himself  wearing  it  out  unnecessarily.  In  a  less  extreme,  one  may  choose 
testing  methods  which  actually  reduce  missile  readiness  from  what  it  could  be. 
Therefore,  it  seems  more  reasonable  to  require  that  the  readiness  testing  do  the 
best  to  maintain  a  launch  ready  missile  over  a  long  period  of  time.  Stating  it 
differently,  we  want  maximum  missile  readiness  at  some  future  time.  Now,  as  soon 
as  we  say  future  time,  we  have  to  back  off  from  certainty  and  admit  probabilities 
of  the  missile  being  launch  ready.  Note  that  the  criterion  has  an  operational 
nature;  inherent  are  the  use  of  the  missile  and  its  test  equipment.  Actually, 
the  statement  applies  to  testing  or  checkout  in  general.  It  could  apply  to  manual 
Minn, .  it's  only  when  you  consider  military  requirements  for  rapid  test  or  for 
remote  control  of  the  test  operation  that  you  are  forced  to  add  the  word  auto¬ 
matic  to  the  two  words  checkout  equipment.  One  final  talking  point,  the  title 
of  this  paper  suggests  that  we  want  to  improve  missile  readiness.  I  can  rephrase 
that  by  saying  that  we  want  to  maximize  this  criterion. 

To  accomplish  our  goal  of  maximum  missile  readiness,  we  must  develop  an 
objective  means  which  will 

1.  Relate  the  goal  to  the  factors  or  parameters  which  determine  it  and  yet 

2.  Allow  us  to  examine  the  individual  subsystems  called  missile  functions. 


I  MINCH  READY  AT  SOME 


Only  then  do  we  have  a  sound  basis  for  determining  the  criteria  for  the 
design  and  use  of  ACE  to  achieve  our  goal  of  maximum  future  miseile  readi¬ 
ness. 

To  start,  ve  need  to  establish  what  the  controlling  parameters  are. 

I  don't  have  time  to  discuss  them  all  so  I'll  give  you  a  few  samples. 

CHART  2 

For  my  example ,  I  have  chosen  a  test  environment  wherein  the  missile 
is  checked  periodically.  Certainly  there  are  others.  On  the  one  band  I 
could  talk  about  constant  tests  of  the  missile;  on  the  other  I  could  talk 
about  no  missile  tests.  We  have  introduced  the  notion  of  time.  Therefore 
time  is  one  of  the  controlling  parameters.  Among  others,  time  for  the 
periodic  inspection,  time  between  periodic  inspections,  time  for  maintenance 
delays,  and  for  repair  actions  must  all  be  Included. 

A  second  notion  we  have  introduced  is  the  missile  being  launch  ready. 
Therefore  we  must  consider  the  states  of  the  missile.  There  are  four. 

The  first  is  launch  ready  or  operative.  The  second  is  malfunction  exists 
but  we  don't  know  it.  The  third  is  malfunction  exists  and  we  do  know  it. 
And  the  fourth  is  in-maintenance. 

I'll  show  you  a  few  other  controlling  parameters  which  are  not  quite 
so  obvious . 


CHART  3 
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The  failure  rates  of  the  Missile  functions.  The  chance  that  the  function 
survive*  the  periodic  inspection.  The  likelihood  that  the  tester  detects  a 
Missile  Malfunction.  And  finally,  the  chance  that  the  tester  makes  a  mis¬ 
take  by  calling  a  good  function  had.  Of  course,  these  input  parameters  do 
not  affect  the  missile  readiness  probability  in  equal  ways.  Consequently 
the  required  accuracy  in  estimating  their  numerical  values  varies.  For 
example,  consider  the  first  -  failure  rates.  We'll  see  liter  on  that  fail¬ 
ure  rates  can  vary  from  cne-tenth  to  one-ten  thousandth.  The  corresponding 
ready  probability  changes  from  one-tenth  to  nine— tenths.  But  one  would  not 
expect  an  estimating  error  to  be  a  factor  of  ten  thousand.  Let's  say  that 

the  error  in  estimating  a  failure  rate  is  a  factor  of  two.  We  estimated  a 

-4 

failure  rate  for  some  missile  function  to  be  10  and  later  we  learn  that  it 
is  really  2  times  10‘^.  Such  an  error  would  change  a  ready  probability  by 
less  than  ten  per  cent.  On  the  other  hand,  if  good  tester  design  practice 
is  used,  then  a  mistake  in  estimating  what  the  tester  error  is  has  a  trivial 
effect  upon  the  missile  readiness  probability.  Well,  there's  a  long  list  of 
controlling  parameters.  But  for  now,  let's  say  that  we  have  the  list. 

Our  next  step  is  to  find  a  means  of  relating  our  goal  to  the  long  list 
of  controlling  parameters .  You  saw  earlier  that  events  in  missile  ground 
life  are  repetitive  or  cyclic.  If  we  take  advantage  of  this  feature  and 
accept  exponential  failure  laws,  then  there  is  a  branch  of  mathematics 
concerning  Markov  Chains  which  is  appropriate.  The  mathematical  model, 
based  on  compound  Markov  Chains,  describes  the  movement  of  the  missile  through 
the  four  states  and  relates  missile  readiness  to  the  list  of  hardware  and 
operational  parameters.  In  addition,  the  model  applies  whether  we  want  to 
consider  the  missile  as  one  piece  or  want  to  consider  seme  individual  missile 
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function  such  as  a  guidance  package.  For  those  of  you  who  are  matheiaatl- 
cally  inclined,  I  have  included  a  few  of  the  underlying  equations  at  the 
end  of  the  written  text,  p— 2269- 

At  this  point  we  have  an  operational  criterion,  the  parameters  which 
determine  the  goal,  and  an  objective  means  of  relating  the  two.  Now  let's 
see  what  happens  when  we  put  the  three  together  to  produce  some  useful 
results.  I  have  two  applications  to  show  you.  The  first  is  general  or 
generic  and  the  Becond  is  specific. 

For  the  generic  application,  we  assumed  characteristic  ranges  of 
numerical  values  for  each  of  the  parameters.  Then  a  high  speed  computer 
determined  the  future  probability  of  being  ready.  From  the  great  bulk  of 
data,  I  have  abstracted  one  set  to  Bhov  you. 


CHART  It 


This  set  of  test  comparison  curves  is  illustrative.  The  curves  apply 
to  one  numerical  set  of  input  parameters.  Change  the  set  and  you  change 
the  curves.  What  do  we  see?  The  curves  relates  ready  probability  to  foil' 
Failure  rates  are  given  in  failures  per  hour. 


ure  rate 8 . 


UNCTION 
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Underneath  I  have  Indicated  a  few  corresponding  mean- ti»e -be tween -fail¬ 
ure  s .  This  failure  rate  can  apply  to  the  entire  missile  or  to  setae  function 
such  as  the  guidance  package  depending  on  the  level  of  detail  vented.  Equip¬ 
ment  is  less  reliable  as  you  go  out  the  horizontal  axis.  At  the  origin  is 
plotted  reliable  equipment  and  the  resulting  high  ready  probability.  Out  at 
the  end  are  less  reliable  equipments  with  low  readiness.  The  brown  curve 
is  a  leave  alone  testing  method  where  the  entire  missile  function  is  re¬ 
placed  every  six  months.  The  green  curve  is  a  30-day  periodic  check. 

Thirty  days  could  be  dictated  by  overall  weapon  system  considerations.  The 
orange  curve  is  continuous  monitoring  of  the  equipment.  To  emphasize  the 
illustrative  intent  of  the  chart.  I'll  repeat  that  the  leave  alone  curve 
has  a  built  in  assumption  of  complete  function  replacement  every  six  months. 
As  the  replacement  period  goes  up  in  time,  the  ready  probability  goes  down. 
Make  the  replacement  period  high  enough  and  eventually  the  leave  alone  curve 
will  drop  beneath  both  the  check  periodic  and  continuous  monitor  curves. 

Not  only  would  the  chart  look  different  but  the  conclusions  you  would  draw 
would  be  different,  too. 

If  you'll  temporarily  accept  my  set  of  input  parameters  as  being  realis¬ 
tic,  we  note  that  from  the  origin  to  slightly  better  than  10  5  leave  alone 
is  the  best  testing  method.  Beet  in  the  sense  that  it  affords  the  highest 
ready  probability.  For  a  short  while  beyond,  a  30-day  check  is  best.  Fran 
then  on,  continuous  monitor  is  best.  Now  what  if  you  don't  like  my  set  of 
input  parameters  which  I  have  been  clever  enough  not  to  show?  Well,  RAND 
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will  soon  have  a  data  volume  available  for  general  use .  It  contains  tables 
relating  ready  probabilities  to  the  input  parameters.  So,  select  your  own 
set,  go  into  the  data  volume  and  plot  your  own  test  comparison  curves. 

That  alternative  is  really  the  purpose  of  the  generic  application;  to  give 
people  the  ability  to  plot  their  own  curves  as  determined  by  their  own  set 
of  input  parameters . 

That's  all  I  have  to  say  on  the  generic  application.  Before  going  on 
to  the  specific  example,  I  want  to  use  these  curves  to  illustrate  the  poten¬ 
tial  barm  in  relying  solely  on  intuitive  choices  for  testing.  Suppose  some 
missile  function  has  a  10_U  failure  rate.  This  rate  corresponds  to  an 
expected  mean-time -betveen-f&ilure  of  about  UOO  days.  Well,  400  days  mean- 
time-between- failure  is  over  twice  our  replacement  period  of  six  months  or 
180  days.  Let's  leave  It  alone.  That  testing  choice  would  result  in  almost 
a  15$  reduction  in  readiness  from  what  it  could  be  with  a  30-day  check. 

■j-ijjl  go  back  now  to  my  discussion  of  the  applications.  For  the  speci¬ 
fic  application  we  designed  a  missile;  not  in  a  disciplined  engineering 
sense  but  in  a  component  failure  sense.  The  exemplary  missile  does  not 
exist.  It  represents  an  advanced,  storable  propellant,  inter -continental 
ballistic  missile.  The  missile  has  two  stages  and  a  re-entry  vehicle. 
Guidance  is  by  an  Inertial  system  .  We  divided  the  missile  into  8  major 
subassemblies -Chart  5  6  hows  two. 


CHART  5 
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Acrose  the  top  are  the  three  testing  methods:  continuous  monitor, 
check  periodic,  and  leave  alone.  Beneath  that  are  failure  rate,  and  r~dy 
probabilities.  The  failure  rates  are  baaed  on  analyses  of  present  day 
ICBM-s.  The  meaning  of  the  10* 6  symbol  is  that  the  failure  rate  is  so 
small  that  it  loses  significance  in  this  work.  As  a  point  of  reference 
this  number  (computer  .00173)  corresponds  to  30  days  mean- time -between- 
f allure.  The  ready  probabilities  were  read  from  a  set  of  working  curves 

similar  to  those  on  the  previous  chart. 

Consider  the  amplifier  channel  entry  -  .9^0,  .961*,  1.0  -  the  leave 
alone  testing  mode  is  best.  The  differences  are  due  mainly  to  the  assumed 
test  inaccuracies  and  test  caused  failures.  It's  true  there  is  a  distinc¬ 
tion  in  ranking  but  the  numerical  differences  are  small  especially  in  light 
of  the  uncertainties  and  Inaccuracies  surrounding  present-day  input  dat-. 
Therefore,  the  important  point  is  not  that  leave  alone  is  best,  but 
rather  that  all  three  testing  methods  produce  similar  results.  This  simi¬ 
larity  permits  the  system  designer  to  choose  between  the  three  on  different 
grounds  than  ready  probabilities  -  cost.  Certainly  it  must  be  cheaper  to 
leave  the  amplifier  alone  than  to  develop,  purchase,  and  operate  automatic 
checkout  equipment. 

The  situation  in  the  inertial  guidance  package  is  quite  different.  By 
assumption,  the  package  is  running  at  all  times  to  meet  a  military  launch 
requirement.  Operating  failure  rates  are  higher  than  would  be  the  case  if 
the  unit  were  in  the  standing  state  of  leave  alone. 

The  stable  platform  ready  probability  for  continuous  monitor  is  over 
, twice  the  value  for  leave  alone.  A  factor  of  two  is  meaningful.  It  also 
points  to  a  second  consideration.  Here  we  have  units  which  are  running. 

In  this  (L.A.)  case  ve  don’t  check  them;  here  (C.M.,C.P.)  we  do.  Suppose 
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a  group  of  engineers  is  designing  a  missile.  They  plan  to  turn  one  function 
on,  say,  to  check  a  second  function,  hut  do  not  plan  to  check  the  first 
function  itself.  Such  planning  has  occurred.  This  difference  illustrates 
the  penalties  involved  in  such  design  practices.  If  you're  going  to  run 
something,  you  better  check  it. 

In  our  specific  application  all  8  major  subsystems  came  out  best  when 
left  alone  with  the  exception  of  the  inertial  guidance  package.  There 
continuous  monitor  is  a  good  choice.  Suppose  we  wanted  to  specify  a 
complete  testing  program  for  the  entire  missile.  Such  a  program  would 
follow  the  outline  I  just  gave.  Even  with  this  best  program,  the  ready 
probability  for  the  entire  missile  as  determined  by  the  products  of  the 
best  ready  probabilities  for  the  individual  functions  is  a  surprisingly 
low  0.25  caused  principally  by  this  set  of  ready  probabilities.  This  low 
number  indicates  that  it  might  be  better  for  our  exemplary  missile  to 
develop  a  guidance  package  that  can  be  brought  from  rest  to  launch  ready  in 
a  short  time  rather  than  to  develop  continuous  monitor  checking. equipment. 
If  we  can  do  this  redesign,  the  inertial  guidance  package  could  be  kept  in 
the  standing  state.  The  failure  rates  would  be  lower,  resulting  in  higher 
ready  probabilities  for  the  inertial  guidance  package  and  a  higher  ready 

probability  for  the  entire  missile. 

In  summary,  I  have  described  a  means  of  relating  missile  readiness  to 
operational  and  hardware  parameters.  The  results  of  this  study  are  useful 
’  to  an  automatic  checkout  equipment  design  in  choosing  the  proper  design 
and  uses  for  such  equipment.  I  believe  the  method  is  most  useful  in  the 
preliminary  design  stage  where  design  choices  must  be  mO* .  It  can  be  erg! 
that  the  values  of  the  input  parameters  are  most  rough  at  that  early  stage 
of  design.  For  example,  failure  rates  based  on  reliability  data  are  input 
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parameters.  The  failure  rate  of  a  computer  under  design  is  not  easy  to  con 
hy.  But  this  argument  doesn't  negate  a  requirement  for  objective  means  to 
establish  design  criteria.  As  a  design  advances,  input  parameters  improve 
in  accuracy  and  the  output  of  the  model  is  correspondingly  improved  in 


value . 
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APPENDIX  1 

The  purpose  of  this  section  is  to  give  the  reader  an  introduction  to 
the  mathematics  underlying  this  paper.  The  author  is  Indebted  to  Mr.  B.  I 
Firstman  for  permission  to  reproduce  here  part  of  his  paper.  Ref  1.  A 
complete  description  of  the  model  will  be  found  in  Ref.  2. 


Problem  Statement 

A  missile  and  ground-operating  equipment  necessary  for  launch  are 
assumed  to  be  composed  of  N  statistically  independent  parts  or  functions. 
It  is  further  assumed  that  the  state— good  or  no  good— of  each  of  these 
functions  can  be  determined  in  terms  of  function  performance  necessary  to 
insure  proper  system  performance.  Because  it  forces  limits  for  a  decision 
of  good  or  bad  to  be  made  in  an  a  priori  sense,  this  assumption  neglects 
the  chance  that  while  a  function  parameter  may  have  drifted  beyond  an  a 
priori  set  limit,  other  system  changes  may  have  occurred  to  compensate  for 
this  drift-  This  undesirable  feature  can  be  alleviated  by  eggregatin*,  mi s 
sile  parts  into  larger  test  units . 

It  follows  from  the  assumption  of  statistical  independence*  that  the 
"e&dy  probability,  P  ,  for  the  entire  weapon  is  given  by 


P 


i,T*  (pi^) 


ijk 


(1) 


- ♦This  assumption  of  statistical  independence  does  not  hold  strictly  for 

all  test  methods.  For  example,  'using  the  continuous  monitor  method  a  common 
test  item  may  monitor  several  functions.  If  these  functions  are  not  grouped, 
then  the  PiJk  estimate  for  each  will  reflect  the  test  equipment’s  failure 

probability,  and  hence,  P  given  by  Eq.  1  will  be  a  conservative  estimate. 

When  this  independence  assumption  fails,  the  effects  on  P  could  be  significant, 
but  the  decision  process  to  be  described  will  be  largely  unaffected.  This 
is  because  each  P1Jk  is  compared  to  each  alternative  P1Jk  estimate  on  an 
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where 

p  »P  (function  1  is  operative,  l.e.,  In  ready  condition 
ijk  if  tested  using  method  J  and  equipment  in  location  k), 
and 


1,  If  readiness- testing  method  J  and  equipment  in 
location  k  is  used  for  function  i 

0,  otherwise 

To  separate  those  functions  that  are  constrained  hy  safety  or  physical 
reasons  from  those  for  which  design  freedom  still  exists,  let  the  constrained 
test  he  indicated  by  ic.  Then 


The  design  problem  can  now  he  stated  as; 

Within  the  constraints  imposed  hy  safety  and  physical  reasons,  and 

within  the  system  readiness  testing  concept,  determine  that  set  of 

x  -  1  so  that  P  given  hy  Eq.  (2)  is  maximum  and 
ijk 

L  x  -  1,  for  each  1. 

J,k  1Jk 


Derivation  of  P 


ijk 


Terms 


Under  the  assumption  that  a  missile  function  is  either  good  or  not 


good  at  any  time,  the  portion  of  the  life  span  of  a  function  that  is  spent 
in  the  silo  can  he  divided  into  five  states: 


individual  htsie  and  in  this  context  each  estimate  is,  in  essence,  separate 
of  the  other  estimates  (except,  of  course,  that  allterms  are  cased  on  this 
same  system  concept)  because  at  that  time.  Just  it  is  being  examined  with 
ail  other  factors  being  held  constant. 
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.1.  Operative,  there  are  no  failures  (malfunctions )  in  the 
function. 

2.  Inoperative- -unknown j  a  disabling  failure  has  occurred  in 
the  function  so  that  it  is  inoperative  but  the  failure  is 
undiscovered. 

3.  inoperative— awaiting  maintenance)  a  disabling  failure  has 
occurred  in  the  function,  it  has  been  discovered,  and  the 
niBsile  is  down  awaiting  maintenance. 

k.  Being  maintained)  the  inoperative  function  is  being  re¬ 
paired  or  replaced  while  the  missile  is  down. 

5.  Undergoing  Periodic  Inspection  or  Preventive  Maintenance) 
the  missile  is  down  while  the  function  (or  all  functions) 
ore  being  inspected  or  replaced. 

Under  these  assumptions  and  definitions,  it  is  necessary  that  all  functions 
on  a  missile  be  in  state  1,  i.e.,  operative,  in  order  for  the  missile  to  be 
ready  to  go. 

Looking  now  at  each  function  separately,  it  is  seen  that  its  life  is 
a  series  of  states  with  defined  paths  of  possible  transitions  from  state  to 
state.  If  the  missile  is  rejuvenated  by  preventive  maintenance  every 
several  years  (perhaps  this  period  is  determined  by  the  shelf  life  of 
storable  propellants  or  c exposition  seals)  then  it  appears  that  wear-out 
failures  can  be  safely  neglected  in  an  examination  of  readiness  testing, 
except  that  proper  attention  must  be  given  to  the  constraints  imposed  on 
the  allowable  types  of  teBts  for  some  functions.*  for  example,  mechanical 

- *Wear^out  phenomena  should  be  considered  when  determining  the  preven¬ 
tive  maintenance  concept — especially  for  functions  that  are  operated 
continuously. 
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parte  with  definite  wear-out  characteristic,  probably  should  not  he  conti¬ 
nuously  exercised.  For  the  readiness -test  concept,  the  concern  should  he 
centered  about  the  randomly  occurring  failures.  And,  for  this  analysis, 
one  should  also  tale  account  of  the  failures  that  are  caused  by  the  readi¬ 
ness  testing;  the  different  methods  of  testing  Impose  different  stresses  on 

the  missile  function. 

One  further  assumption  Is  needed  before  the  analysis  can.  continue; 
that  of  exponentially  distributed  failures.  The  justification  for  this 
assumption  and  the  conditions  under  which  it  is  reasonable  have  been  dis¬ 
cussed  in  numerous  reports  (Refs.  3  for  example)  and  will  not  be  discussed 
here.  This  appears  to  be  a  reasonably  good  assumption  for  many  physical 
functions,  other  than  electronic,  and  there  is  much  experimental  evidence 
to  Justify  its  (cautious)  use. 

Because  of  the  preceding  assumptions  on  the  statistics  of  the  failure 
distribution,  it  is  seen  that  the  probability  of  a  function  failing  in  a 
given  period  is  dependent  only  on  the  length  of  the  period  and  the  opera¬ 
tional  stresses,  and  is  thereby  independent  of  the  number  of  periods  of 
previous  use.  All  other  state -to- state  transitions  depend  only  on  the 
existing  state  and  the  state  to  which  the  movement  is  to  be  made.  There¬ 
fore,  the  progress  of  a  particular  function  through  its  operational  life¬ 
time  can  now  be  viewed  as  a  Markov  Process  which  will  be  described. 

Check  Periodically 

The  process  of  checking  periodically  is  the  most  tractable  of  the  two 
active  readiness-testing  methods  and  will  be  treated  as  an  example;  the 
monitor  continuously  and  leave-alone  a* thole  are  discussed  in  Ref.  2.  The 
length  of  time  between  periodic  inspections  that  gives  the  best  system 
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performance  is  assumed  to  be  given  by  the  system  concept;  this  time  between 
periodic  inspections  viil  be  called  T.  Saeh  miBsile  function  that  uses  the 
cheek  periodic  method  is  inspected  every  T  days,  and  because  of  the  nature 
of  the  system,  defects  that  have  occurred  in  the  function  can  be  detected 
only  at  the  time  of  the  periodic  inspection. 

It  will  prove  useful  to  break  the  T  days  down  into  n^  smaller  time 
periods  of  t1  hours  each  and  the  time  required  for  the  missile  periodic 
inspection  e  so  that  a  periodic  interval  appears  as 


To  further  simplify  the  analysis,  the  quantity  of  time  is  defined 
to  be  the  average  length  of  time  required  to  repair  or  replace  the  1th 
function.  This  includes  all  time  required  to  travel  to  the  missile,  unbut¬ 


ton  the  silo,  remove  and  repair  or  replace,  etc. 

Projecting  the  function's  operations  into  the  future,  it  appears  as  a 
series  of  intervals  of  length  T,  that  is  finally  ended  at  the  time  of  launch 


launch 


The  movements  of  a  missile  function  through  this  pattern  must  of  necessity 
demonstrate  periodic  properties.  The  chance  of  a  transition  from  one  state 
to  another  will  depend  on  whether  the  potential  movements  occur  during  a 
periodic  inspection,  or  between  inspections.  It  will  be  convenient,  there¬ 
fore,  to  define  three  transition  matrices:  A  defined  over  t^,  B  defined 


over  0,  and  C  defined  over  T. 
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For  the  state a  numbered: 

1.  Operative 

2.  Inoperative --unknown 

3.  Inoperative — awaiting  maintenance 

4.  Being  maintained 

(NOTE:  The  state  of  being  inspected  ie  handled  differently} 
a  transition  matrix  will  be  defined  for  it. ) 

A  *  matrix  of  single-step  transition  probabilities  in  time  t^,  for 
the  interval  between  periodic  inspections. 


A 


a  matrix  of  terms  arB 


where 


a  «■  P  (transition  from  state  r  to  state  b  in  one  interval 
rs 

of  length  t^) 

Similarly,  for  the  periodic  inspection 

B=  matrix  of  single-step  transition  probabilities  in  time  0,  for  the 
periodic  inspection. 


where 


b  -  P  (transition  from  state  r  to  state  s  during  the 
rs 

periodic  inspection) . 

The  process  to  be  described  moves  through  n^  steps  of  length  t4  des¬ 
cribed  by  A,  and  one  step  of  length  0  described  by  B,  for  each  large  step, 
or  period,  in  its  life.  A  matrix  is  needed  to  describe  transitions  over 
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the  entire  period  T • 

C  s  matrix  of  single-step  transition  probabilities  In  time  T  »  +  0. 

If 

5  p  (transition  from  state  r  to  state  s  In  one  Interval  of 
length  T), 

and  If  it  Is  observed  that  each  tern  c  Is  a  term  compounded  from  ar8  and 

rs 

b  terms j  that  Is  (changing  notation  slightly  for  the  sake  of  clarity).  If 
1*6 

a  «p  (t  ),  the  probability  of  moving  from  state  r  to  state  v  In  time  t. 
rv  rv  1 

and  bvE  =  Pvs ( 8 ) ,  the  probability  of  moving  from  state  v  to  state  s  In  time 
0,  then 


c  -  p  (n  t  +  ©) 
rs  *re  1  1 


-  L  r^Vi1  pvs(0) 
V 

By  induction,  it  con  be  shovn  that 
a”1"  {  Prv(Vl  ' 

and 


B-  i 


so 


°  ■  (°r.} 

is  given  by 

nl 

C  -  A  B. 
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The  next  step  in  finding  the  long-run  probability  of  being  in  state  1 

(m) 

is  to  define  the  m-step  absolute  probability  vector  x 


(m) 

x 


where 

x  ^  -  p  (function  being  in  state  k  after  m  periodic  intervals) 

and 

(m+1)  (m) 

x  -  x  C 

This  vector  has  the  property  that  if  the  process  is  allowed  to  continue 
sufficiently  long  that  the  effects  of  the  initial  distribution  of  states 
have  been  dissipated,  then  for  sane  large  m,  a  steady  state,  or  fixed, 
probability  vector  la  given  by 

x  «  xC  (l4> 

That  is,  the  long-run  distribution  of  states  following  a  periodic  inspection 
should  be  unaffected  by  an  additional  period  and  periodic  inspection. 

Solving  for  the  vector  x  (for  this  problem,  thl6  involves  the 
solution  of  5  simultaneous  linear  equations}  one  for  each  and  one  that 
expresses  the  sum  of  the  x^  s  equals  unity)  gives  the  probability  of  the 
function  being  in  each  state  following  a  periodic  inspection  that  is  con¬ 
veniently  long  removed  from  the  tine  of  initial  installation.  In  particular, 
this  could  be  the  inspection  that  precedes  the  beginning  of  hostilities. 

Hostilities  can  begin  at  any  randomly  chosen  time  (with  respect  to  the 
readinesB  testing  schedule)  and,  therefore,  a  measure  is  needed  .  or  the 
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probability  of  each  function  being  operative  at  any  randomly  chosen  future 
time.  If  the  vector  describing  the  state  probabilities  in  the  time  follow¬ 
ing  a  (steady  state)  periodic  inspection  is  given  by  x,  as  l>efore,  then  for 

r  times  periods  of  length  t.  later 

1  /  _  \ 


(r)  (r)  (r)  (r)  (r) 

x  -  (xi  ,  xg  ,  ,  *k  ) 

Neglecting  0,  for  0  ^  t  and  in  turn  t  «=■«  T,  and  therefore  only  a  small 
error  will  result,  the  probability  of  the  function  being  operative  at  time 
of  launch  is 

E  y  ^  ^  m  p  =  _i_  ^  for  each  j  and  k.  (16) 

E  L  I  ^  ^  *1 

(r) 

The  reason  for  this  form  of  the  expectation  of  x^  over  the  n^  time 
interval  is  because  the  launch  attempt  could  occur  at  any  time  with  equal 


likelihood. 

The  necessary  matrices  must  now  be  developed  using  terms  describing 
the  missile  function's  physical  characteristics,  the  test  equipment's  capa¬ 
bilities  and  error  propensities,  and  the  system  operation  and  maintenance 
concepts.  This  is  an  involved  and  somewhat  lengthy  process,  but  not  diffi¬ 
cult.  Because  it  is  not  essential  to  an  understanding  of  the  essence  of 
the  problem  and  solution,  it  will  not  be  presented  in  this  paper;  it  is 


contained  in  Ref.  2. 
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